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Abstract — We show that for those lattices of Voronoi's first 
kind, a vector of shortest nonzero Euclidean length can computed 
in polynomial time by computing a minimum cut in a graph. 

Index Terms — Lattices, short vectors, minimum cut. 

I. Introduction 

A n-dimensional lattice, A, is a discrete set of vectors from 
R m , m > n, formed by the integer linear combinations of a set 
of linearly independent basis vectors b\, . . . , b n from R™. That 
is, A, consists of all those vectors, or lattice points, x G R m 
satisfying 

x = b\U\ + b 2 u 2 + • • • + b n u n u n G Z. 

An interesting question about a lattice is: 'What is the 
shortest distance between any two lattice points?' Because the 
origin is a lattice point this question can be equivalently stated 
as: 'What is the length of the shortest lattice point not equal 
to the origin?' Those points in the lattice with shortest length 
are called short vectors. The problem of discovering a lattice 
point of shortest length is called the shortest vector problem 
and has applications to, for example, cryptography [Q]]. In 
general, i.e. for arbitrary lattices, the shortest vector problem 
is NP-hard [2, 3fl However, for some lattices, the problem is 
easy to solve. For example, short vectors are relatively easy to 
determine in highly regular lattices, such as the root lattices 
A n and D n , their dual lattices A* and D*, and the integer 
lattice Z" Chap. 4]. 

In this paper we consider a particular class of lattices, 
those of Voronoi's first kind 05|47|]. We show that a short 
vector in a lattice of Voronoi's first kind can be computed in 
polynomial time by computing a minimum cut in a graph. If 
the lattice has dimension n, this requires 0(n 3 ) operations to 
deterministically compute a short vector [81], or 0(n 2 (log n)f) 
operations to compute a short vector with high probability H. 

The paper is structured as follows. Section HI] defines the 
short vectors of a lattice along with some related entities, 
the Voronoi cell and the relevant vectors. Section [Til] defines 
lattices of Voronoi's first kind and shows how their short 
vectors can be found by solving a constrained quadratic 
program in binary {0, 1} variables. Section ITVl describes how 
this constrained program can be mapped into that of computing 
a minimum cut in a weighted graph. Some examples are given 
in Section M 

1 Specifically, the shortest vector problem is known to be hard for NP under 
what are called reverse unfaithful random reductions Ql. 



II. Voronoi cells, relevant vectors, and short 

VECTORS 

The (open) Voronoi cell, denoted Vor(A), of a lattice A 
in R" is the subset of R™ containing all points nearer, with 
respect to a given norm, the lattice point at the origin than 
any other lattice point. The Voronoi cell is an n-dimensional 
convex polytope that is symmetric about the origin. Here 
we will always assume the Euclidean norm (or 2-norm), so 
Vor(A) contains those points nearest in Euclidean distance to 
the origin. 

Equivalently the Voronoi cell can be defined as the inter- 
section of the half spaces 

H v = {x G R" | x ■ v < \v ■ v} 

for all v G A\{0}, i.e. all lattice points v G A not equal to 
the origin 0. Here x ■ v is the inner product between vectors x 
and v. It is not necessary to consider all v G A\{0} to define 
the Voronoi cell. The minimal set of lattice vectors 1Z such 
that Vor(A) = r\ ve -jiH v is called the set of Voronoi relevant 
vectors or simply relevant vectors 0]. 

Definition 1. The relevant vectors v G A are those for which 

v • x < x ■ x 

for all x G A with i/d and x ^ oJ^| 

The short (or minimal) vectors in a lattice are all those 
lattice points of minimum nonzero Euclidean length, i.e all 
those of squared length 



Plainly, every short vector is also a relevant vector, because, 
if a lattice point s is not relevant there exists a lattice point 
x ^ s such that x ■ s < s ■ s, implying that ||x|| 2 < ||s|| 2 , so s 
is not a short vector. 

III. Lattices of Voronoi's first kind 

An n-dimensional lattice A is said to be of Voronoi 's first 
kind if it has what is called an obtuse superbase |Ht]. That 
is, there exists a set of n + 1 vectors b\, . . . , such that 
6i , . . . , b n are a basis for A, 

bi+b 2 --- + b n+1 =0 (1) 

2 These are the 'strict' relevant vectors according to Conway and Sloane |5]. 
If the inequality v ■ x < x ■ x is replaced by v ■ x < x ■ x then this would 
also include the 'lax' relevant vectors. The short vectors are always strict so 
we only have use of the strict relevant vectors here. 



(the superbase condition), and the inner products satisfy, 



for 



i,j = l,...,n+l,i^ j 



(the obtuse condition). The q.- L j are called the Selling parame- 
ters. It is known that all lattices in dimensions less than 4 are 
of Voronoi's first kind |5[]. An interesting property of lattices 
of Voronoi's first kind is that their relevant vectors have a 
straightforward description. 

Theorem 1. (Conway and Sloane [5, Theorem 3]) The rele- 
vant vectors of A are of the form, 

iei 

where I is a strict subset of {1, 2, . . . , n + 1} that is not empty, 
i.e. I C {1, 2, . . . , n + 1} and 7^0. 

Because each short vector is also a relevant vector we have 
the following corollary. 

Corollary 1. The short vectors in A are of the form ^2 ie j bi 
where I C {1, 2, ...,»+ 1} and 7^0. 

Given this corollary a naive way to compute a short vector 
is to compute the squared length HX)ie/^*ll 2 f° r a ^ °f tne 
2" +1 — 2 possible 7 and return a lattice point with minimum 
squared length. This procedure requires a number of opera- 
tions that grows exponentially with the dimension n. We can 
improve this using a minimum cut algorithm. To facilitate this 
consider the quadratic form 



n+l 



/i + l n+l 



Q( u ) = II ^2 Mtll 2 = ^2 ^2 qijUiUj. 



(2) 



i=i 



= 1 3 = 1 



A short vector is a minimiser of this form under the constraint 
that the Ui G {0, 1} and at least one element of u is equal 
to 1 and at least one element of u is equal to 0. The next 
section will show how this constrained quadratic minimisation 
problem can be solved by computing a minimum cut in a 
graph. This technique has appeared previously Hiol - 12 ] but we 
include the derivation here so that this paper is self contained. 

IV. Quadratic {0, 1} programs and minimum cuts in 

GRAPHS 

Let G = {V, E} be an undirected graph with n + l vertices 



vi,...,v n +i contained in the set V and edges 



G E 



the vertices in C to the vertices in C. If the graph is allowed 
to contain loops, i.e. edges from a vertex to itself, then the 
weight of these edges iw„ have no effect on the weight of any 
cut. We may choose any values for the wu without affecting 
W{C,C). 

The minimum cut is the C and C that minimise the weight 
W(C, C). Let \V\=n + l and \E\ < ±(n + l)n denote the 
number of vertices and the number of edges in the graph G. 
If all of the edge weights uiq for i ^ j are nonnegative, a 
minimum cut can be computed deterministically in order 

0(\V\\E\ + \V\ 2 log\V\) G 0(n 3 ) 

arithmetic operations using the algorithm of Stoer and Wag- 
ner |01 and with high probability in 

0(|V| 2 (log|y|) 3 ) = 0(n 2 (log(n)) 3 ) 

operations using the randomised algorithm of Karger and 
Stien §]. 

We now show how W(C, C) can be represented as a 
quadratic form. Define the vector u of length n + 1 so that 



1, i G C 



Then 



Ui(l - Uj) 




0, otherwise. 
The weight can now be written as 

n+l n+l 

w(c, c) = j2Y, w v = Y,Yl - ^) = F ^> 

ieC j£C i=l 3 = 1 

say. Finding a minimum cut is equivalent to finding the binary 
{0, 1} vector u that minimises F(u) under the constraint that 
at least one element in u is equal to 1 and at least one 
element in u is equal to 0. This constraint corresponds to the 
requirement that both C and C are nonempty. 
Expanding, 



n+l n+l 



*•(«) = EE 

i = l j=l 
n+l 



n+l n+l 
WijUi - 2J WijUiUj 
i=l 3 = 1 



n+l n+l 
y j kiUi - 22 w ij u i u 3> 



t=l j=l 



connecting vertex Vi to vertex Vj. To each edge we assign a 

weight (or capacity) Wij G M. The graph is undirected so the where hi = X^=i w ij- Observe the equivalence of F(u) and 



weights are symmetric, i.e. Wij = Wji. A cut in the graph G is 
a nonempty subset C C V of vertices with its (also nonempty) 
complement C C V. That is, a cut is the pair (C, C) such that 
both C and C are not empty, C n C = and C U C = V. 
The weight of a cut is 



Q(u) from (O when the weights are assigned according to, 



qij 



for 



i,j = l,...,n+ 1. 



w(c,c)^j2J2 



13 ) 



where 7 = {i \ Vi G C} and J = {j | Vj G C}. That is, 
W(C, C) is the sum of the weights on the edges crossing from 



Note that with these weights fej = — X)j=o = due to the 
superbase condition (Q]). 

Because the <7jj are nonpositive for i ^ j the weights are 
nonnegative for all i ^ j with i,j G {1, n + 1}. As discussed 
the value of the weights wu have no effect on the weight of 
any cut so setting qu = —wu for i G {1, n + 1} is of no 
consequence. A vector u that minimises Q(u) can be found 



by computing a minimum cut in the graph with these weights. 
A short vector is then given as Y^i=i biUi. This is our main 
result, so we restate it as a theorem. 

Theorem 2. Let A be a n- dimensional lattice of Voronoi's 
first kind with obtuse superbase b\, . . . , b n +i and Selling 
parameters qu — bi ■ bj. Let G be a graph with n+ 1 vertices 
v\, . . . , V n +i an d edges eij with weight —qtj. Let (C, C) be 
a minimum cut in the graph G. A short vector in the lattice 
A is given by ^2 ieI bi where I = {i | Vi € C}. The squared 
Euclidean length of the short vector is given by the weight of 
the minimum cut W{C, C). 

V. Some examples 

As examples we apply this minimum cut approach to finding 
a short vector in the root lattice A n and its dual lattice A* ||4|, 
pp. 108-117]. An obtuse superbase for A n is all the cyclic 



Set the vectors, 



shifts of the vector [ 1 
Set the vectors, 



-10 



h 
b 2 



'n+l 



[1-10 
[01-10 



] from R n+1 . 

0] 
o 1 



[ -1 ■•• 1 ] . 



The Selling parameters are 



bi ■ bi 



i = J 

i — j = 1 mod n + 1 



otherwise. 



The corresponding weighted graph is the cycle graph with 
n + l vertices, each edge having weight 1. A minimum cut 
in this graph is to choose C to contain c consecutive vertices 
modulo n + 1, where 1 < c < n. That is, choose 

C = {vi,v i+1 , . . .v i+c } 

for any integer i where the indices are considered modulo 
n + l. The weight of such a cut is 2. A short vector in A n is 
correspondingly of the form 



i+c 



~*i+c 



where G R™ +1 denotes a vector of all zeros except the 
ith element which is equal to one. Again, the indices here 
are considered modulo n + l. The squared Euclidean length 
of this short vector is 2. It follows that short vectors in A n 
are of the form es — ej for i,j G {1, . . . ,n + 1}, i + 1 j, a 
well known fact pp. 108-117]. Figure [TJ displays the graph 
corresponding to the lattice A3. 

An obtuse superbase for the dual lattice A* is all cyclic 
shifts of the vector 



[ 



1 

' n+l 



1 

n+l 



u _ r L_ a 

u 2 — [ n+l n+l 



1 

" n+l 
1 

'n+l 



1 

' n+l 



bn + 1 = [ 

The Selling parameters are 



1 

n+l 



1 

'n+l 
1 

'n+l 



n+l n+l 



<kj = bi-bj = < n 2T 

I n+l ■ 



i = 3 
otherwise. 



The corresponding graph is the complete graph with n+l 
vertices and |(n + l)n edges, each edge having weight 
As each weight is equal and the graph is complete, a minimum 
cut is given by placing precisely one vertex into C and the 
remaining vertices into C. The weight of this cut is ^xj. All 
the superbase vectors 61, ... , & n +i are short vectors of squared 
Euclidean length ^pj, again a well known fact J4|, pp. 108- 
117]. Figure [2] shows the graph corresponding to the lattice 
A* 

In both of the previous examples short vectors could be 
obtained by picking one of the vectors bi, . . . , b n +i in the 
obtuse superbase. This is not always the case, as our final 
example will show. Consider the 3 -dimensional lattice with 
obtuse superbase 



[ 1 



-h 1 



h = 
b 2 = 
& 3 = [ 1 ] 

b 4 = 



(3) 



-i -i -1 
22 



The Selling parameters are given in matrix form as 



<?n <7i2 9i3 Qii 

<Z21 922 923 924 

931 932 933 934 

941 942 943 944 





1 

-1 



_ 1 

J 

4 

-1 

3 
2 



Figure [3] displays the corresponding graph. The minimum cut 
is given by choosing C = {vi,V2} and C = {v3,V4}. This 
corresponds to the short vector 







of squared Euclidean length |. Note that each of 61 , 62,^3 
and 64 have squared Euclidean length greater than | and are 
therefore not short vectors. 

VI. Conclusion 

We have described a method from computing a short vector 
in a lattice of Voronoi's first kind. This is achieved by mapping 
the shortest vector problem into that of computing a minimum 
cut in a weighted graph. Existing polynomial time algorithms 
can then be applied 
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Vl v 4 
Fig. 1. Graph corresponding to the lattice A3. 

V 2 V 3 





Vl V 4 
Fig. 3. Graph corresponding to the lattice with superbase given by ^3). 
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